The agentic AI workflows enterprises are racing to deploy have a hidden flaw: the LLMs inside them corrupt the documents they process. In a new study, Microsoft tested 19 LLMs in 52 professional fields, and after a single round of edits, 18% of document content had diverged from the original. More than half of a document’s content became corrupted after 20 interactions. Moreover, giving models agentic tool use — widely assumed to improve reliability — actually degraded document fidelity slightly further.
For IT leaders, this puts a name to a risk most governance frameworks have not yet accounted for: LLM document corruption enterprise. This silent corruption of documents by LLMs — a problem enterprise teams now have to manage alongside hallucination and data leakage. As agents read, summarise, and act on contracts, policies, ledgers, and case files at scale, the documents themselves are degrading silently, with no error message and no audit trail.
Here are the findings of the research, why agentic workflows exacerbate the issue, and how IT leaders can address it.
In May 2026, the paper titled LLMs Corrupt Your Documents When You Delegate was picked up by IBM Think and has been circulating widely among enterprise AI teams since then. The researchers built DELEGATE-52, a benchmark dataset covering documents across 52 professional fields, from accounting ledgers to aviation bulletins. For each document, they designed paired edit tasks: a ‘forward’ instruction and a ‘backward’ instruction that reverses the original edit. Theoretically, each round trip should restore the document to its initial state. In reality, it never did.
Corruption was worst for natural language prose, exactly the format most enterprise knowledge lives in. Structured, repetitive content such as code was almost perfectly preserved. The errors were what the authors call ‘sparse but severe’: small, silent changes that compound over long interactions, precisely the kind that slip past human review.
Counterintuitively, yes. When researchers gave models a basic agentic harness with tools, performance did not improve and in some configurations slightly declined. The explanation is context length. Agentic workflows consumed 2–5 times more input tokens per task, and LLM accuracy is known to degrade as context grows. As IBM Distinguished Engineer Mihai Criveti put it in the IBM Think piece, ‘just because something like Opus now supports a 1 million-token context window doesn’t mean it can effectively use 1 million tokens. Many models start to struggle at around the 10,000-token mark.’
The researchers also note that their simulation parameters “underestimate enterprise scale”. Real deployments involve larger documents, longer chains of interaction, and far more distractor content, all three of which the study found make degradation worse. In other words, the conditions inside a typical AI workflow automation deployment are harsher than the ones that produced these numbers.
The timing is uncomfortable. As IBM’s 2026 Institute for Business Value survey of 2,000 technology executives revealed, organisations are predicting a 38% jump in deployed AI by 2027, but 77% report that AI adoption is outpacing their governance capabilities. Surveyed organisations logged an average of 54 AI agent incidents in 2025 requiring human correction, and 37% of the high-severity ones involved data exposure or security breaches.
Now layer document corruption on top. A records management officer cannot certify the integrity of a retention archive that AI agents have been rewriting. A legal team cannot rely on a contract that an AI assistant has summarised, amended, and re-saved multiple times. A regulated firm cannot demonstrate to an auditor which version of a policy document is authoritative if every AI touch introduced silent drift. This is a new category of AI risk management, and most frameworks were built to catch hallucinated answers, not corrupted source documents.
The research shows that the less an LLM rewrites a source document, the more intact its content remains. Before their next agentic deployment, IT leaders should implement four safeguards:
Separate reading from writing
Let AI retrieve and reason over documents through a governed retrieval layer, rather than editing the originals in place.
Keep an immutable source of truth
Version every document and verify AI outputs against the original, so drift is detectable rather than silent.
Chunk and scope context
Feed models only the relevant document segment, keeping interactions well within the context window where accuracy holds — typically under 10,000 tokens for most current models.
Embed governance into the system
IBM’s study found organisations that build control directly into their AI systems experience 25% fewer incidents than those relying on manual oversight alone — making embedded governance a measurable advantage, not just best practice.
Safeguarding enterprise document intelligence is precisely what Vaultiscan is built for. Instead of repeatedly editing source documents, Vaultiscan connects them into an organisation’s private, retrieval-ready knowledge layer. Vaulti Lake organises structured and unstructured content into a verified, queryable data foundation.
Vaulti GPT enables teams to query this knowledge without altering the original documents. Vaulti SDK allows engineering teams to incorporate the same governed retrieval into their workflows.
Document integrity is preserved: source files are never altered and remain entirely within the organisation’s control. Vaultiscan gives enterprises the architecture and governance layer needed to deploy AI over their document estate without compromising integrity.
What is LLM document corruption?
It is the silent degradation of a document’s content each time an LLM reads and rewrites it. In Microsoft’s DELEGATE-52 research, 18% of content changed significantly after one edit round trip, more than 50% after twenty interactions.
Does agentic AI make document corruption worse?
The research found basic agentic tool use did not improve document fidelity and slightly worsened it — largely because tool-using agents consume two to five times more context tokens, and accuracy degrades as context windows grow.
How can enterprises protect documents from AI corruption?
Keep an immutable source of truth, let AI retrieve rather than rewrite, scope context to what each task needs, and embed governance into the AI system itself instead of relying on manual review.
The findings from Microsoft’s research align with what many enterprises have experienced but couldn’t quantify: LLMs are not reliable custodians of the documents they touch, and the risk grows significantly at agentic scale. But the answer is not to slow down the adoption of AI. The answer is to redesign the architecture, so models retrieve from a governed, verified knowledge layer rather than rewriting the record itself.
Enterprises that make that shift retain the speed of an enterprise AI platform and the integrity that their auditors, lawyers, and customers depend on. Request a demo to see how Vaultiscan preserves document integrity across your data estate.
Fill in your details and our team will contact you to discuss your use case and next steps.
Just a few details to begin.
By submitting, you agree to our Terms & Privacy Policy.
